Oracle SOA Suite EUVD-2026-106476

Exploitation requires network reachability to the Oracle SOA Suite server's T3 or IIOP remoting listeners (the WebLogic/Fusion Middleware protocols), targeting the Fabric Layer component on affected versions 12.2.1.4.0 and 14.1.2.0.0. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special non-default configuration are needed - this is unauthenticated remote exploitation against standard deployments. The primary limiting factor is network exposure: environments that firewall or do not expose T3/IIOP (e.g., only HTTP/HTTPS published, or listeners restricted to trusted management networks) substantially reduce reachable attack surface. Only the two listed versions are confirmed affected.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 base score is a maximal 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning network-reachable, low-complexity, unauthenticated exploitation with no user interaction, a scope change, and complete confidentiality, integrity, and availability impact (full product takeover). The attack vectors - T3 and IIOP - are WebLogic/Fusion Middleware remoting protocols that are frequently exposed and have a long history of pre-authentication deserialization RCE in Oracle middleware, which materially raises real-world exploitability beyond the raw score. No EPSS probability was supplied, so widespread-versus-targeted exploitation likelihood cannot be quantified from the input. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no confirmed active exploitation at this time; no SSVC decision data was provided. The core tension is between a perfect, unauthenticated-RCE CVSS profile and the absence of KEV/EPSS/POC evidence - this pattern is typical of a freshly published Oracle Critical Patch Update issue where exploitation signals simply have not matured yet, rather than evidence of low real risk. Given Oracle middleware's history, defenders should treat weaponization as a matter of time and patch on the critical track.

A remote, unauthenticated attacker who can reach the exposed T3 or IIOP listener of an Oracle SOA Suite server (Fabric Layer) sends a crafted request that compromises the server with no credentials or user interaction. Because the vulnerability carries a scope change, successful exploitation can pivot beyond SOA Suite to significantly impact additional co-hosted products, enabling full takeover. No public proof-of-concept is referenced in the provided data, but the T3/IIOP vector is consistent with prior Oracle Fusion Middleware deserialization RCE classes.